ssh: connection closed

Question

I can connect to my Mac Mini using SSH without any problem:

remote_machine$ ssh corti@mymacmini
mymacmini$

By using another user I get

remote_machine$  ssh -i /etc/nagios/.ssh/id_rsa -l nagios mymacmini
Connection closed by remotemachine port 22

the same happens with username and password:

remote_machine$  ssh nagios@ mymacmini
(nagios@ mymacmini) Password:
Connection closed by remotemachine port 22

On the Mac Mini I just see (before entering the password):

2024-05-05 15:00:47.768507+0200 0x140fa    Error       0x0                  5959   0    sshd: (libsystem_info.dylib) [com.apple.network.libinfo:si_destination_compare] send failed: Invalid argument
2024-05-05 15:00:47.768973+0200 0x140fa    Error       0x0                  5959   0    sshd: (libsystem_info.dylib) [com.apple.network.libinfo:si_destination_compare] send failed: Invalid argument
2024-05-05 15:00:47.768994+0200 0x140fa    Error       0x0                  5959   0    sshd: (libsystem_info.dylib) [com.apple.network.libinfo:si_destination_compare] send failed: Invalid argument

and after logging in:

2024-05-05 15:00:58.622515+0200 0x13486    Error       0x0                  324    0    symptomsd: (NetworkStatistics) [com.apple.networkstatistics:NetworkStatistics] Source 37877 old attribution launchd new attribution com.openssh.sshd

and here the verbose output on the remote machine

[nagios@matteo ~]$  ssh -i /etc/nagios/.ssh/id_rsa -l nagios casa.corti.li -vvv
OpenSSH_9.6p1, OpenSSL 3.2.1 30 Jan 2024
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 55: Including file /etc/ssh/ssh_config.d/50-redhat.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug2: checking match for 'final all' host casa.corti.li originally casa.corti.li
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 3: not matched 'final'
debug2: match not found
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only)
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-]
debug3: kex names ok: [curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512]
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 55: Including file /etc/ssh/ssh_config.d/50-redhat.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
debug2: checking match for 'final all' host casa.corti.li originally casa.corti.li
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 3: matched 'final'
debug2: match found
debug3: /etc/ssh/ssh_config.d/50-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-]
debug3: kex names ok: [curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512]
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/var/spool/nagios/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/var/spool/nagios/.ssh/known_hosts2'
debug2: resolving "casa.corti.li" port 22
debug3: resolve_host: lookup casa.corti.li:22
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to casa.corti.li [51.154.164.133] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x48
debug1: Connection established.
debug1: identity file /etc/nagios/.ssh/id_rsa type 0
debug1: identity file /etc/nagios/.ssh/id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.6
debug1: compat_banner: match: OpenSSH_9.6 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to casa.corti.li:22 as 'nagios'
debug3: record_hostkey: found key type ED25519 in file /var/spool/nagios/.ssh/known_hosts:4
debug3: record_hostkey: found key type RSA in file /var/spool/nagios/.ssh/known_hosts:10
debug3: load_hostkeys_file: loaded 2 keys from casa.corti.li
debug1: load_hostkeys: fopen /var/spool/nagios/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: have matching best-preference key type [email protected], using HostkeyAlgorithms verbatim
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-c,[email protected]
debug2: host key algorithms: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: [email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
debug2: ciphers stoc: [email protected],[email protected],aes256-ctr,[email protected],aes128-ctr
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha1,[email protected],hmac-sha2-512
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: [email protected],curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-s,[email protected]
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-ed25519
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug3: kex_choose_conf: will use strict KEX ordering
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug1: kex: curve25519-sha256 need=32 dh_need=32
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:qamie2fLX+6WdLAAdpR11uX7gJtkrJFW6QLxhoj0HfA
debug3: record_hostkey: found key type ED25519 in file /var/spool/nagios/.ssh/known_hosts:4
debug3: record_hostkey: found key type RSA in file /var/spool/nagios/.ssh/known_hosts:10
debug3: load_hostkeys_file: loaded 2 keys from casa.corti.li
debug1: load_hostkeys: fopen /var/spool/nagios/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'casa.corti.li' is known and matches the ED25519 host key.
debug1: Found key in /var/spool/nagios/.ssh/known_hosts:4
debug3: send packet: type 21
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: Sending SSH2_MSG_EXT_INFO
debug3: send packet: type 7
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 4294967296 blocks
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256>
debug3: kex_input_ext_info: extension [email protected]
debug1: kex_ext_info_check_ver: [email protected]=<0>
debug3: kex_input_ext_info: extension [email protected]
debug1: kex_ext_info_check_ver: [email protected]=<0>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256>
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Will attempt key: /etc/nagios/.ssh/id_rsa RSA SHA256:yzQSCODjDcIoEfU3+hw6veILQHwnID7XWYIVklMO94E explicit
debug2: pubkey_prepare: done
debug1: Offering public key: /etc/nagios/.ssh/id_rsa RSA SHA256:yzQSCODjDcIoEfU3+hw6veILQHwnID7XWYIVklMO94E explicit
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /etc/nagios/.ssh/id_rsa RSA SHA256:yzQSCODjDcIoEfU3+hw6veILQHwnID7XWYIVklMO94E explicit
debug3: sign_and_send_pubkey: using [email protected] with RSA SHA256:yzQSCODjDcIoEfU3+hw6veILQHwnID7XWYIVklMO94E
debug3: sign_and_send_pubkey: signing using rsa-sha2-256 SHA256:yzQSCODjDcIoEfU3+hw6veILQHwnID7XWYIVklMO94E
debug3: send packet: type 50
Connection closed by 51.154.164.133 port 22

Any hint on how to debug or solve the problem?

Edit

The user account is working: it has an home directory with the correct permissions and a login shell (BTW I tried with bash and zsh).

I can su without problems:

$ sudo su - nagios

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.
For more details, please visit https://support.apple.com/kb/HT208050.
mini:~ nagios$ ls -ld .
drwxr-xr-x@ 16 nagios  staff  512 May  5 14:50 .
mini:~ nagios$ ls -ld .ssh/
drwx--x--x  4 nagios  staff  128 May  5 14:43 .ssh/
mini:~ nagios$ ls -l .ssh/
total 16
-rw-------  1 nagios  staff  747 May  5 14:43 authorized_keys
-rw-r--r--  1 nagios  staff  501 May  5 14:50 known_hosts

Edit 2

I went to sleep and this morning everything was working again.

Is there similar to fail2ban that could temporarily block some logins? (BTW I do not use fail2ban on MacOS must be something else)

Edit 3

The sshd configuration does not show anything special:

$ grep -v ^# /etc/ssh/sshd_config
Include /etc/ssh/sshd_config.d/*
AuthorizedKeysFile  .ssh/authorized_keys

$ cat /etc/ssh/sshd_config.d/*
# Options set by macOS that differ from the OpenSSH defaults.
UsePAM yes
AcceptEnv LANG LC_*
Subsystem   sftp    /usr/libexec/sftp-server

Edit 4

I rebooted the machine and the problem is back.

But this time I see:

2024-05-13 15:26:52.742677+0200 0x20207    Default     0x0                  10904  0    sshd: fatal: Access denied for user nagios by PAM account configuration [preauth]

But:

PAM is disabled in the SSH configuration
User has "remote login" enabled in the settings

Is there anything of interest in the log files on server side? — nohillside, Commented May 5 at 13:17
@mmmmmm The shell was bash, changed it to zsh. Same behavior. Then changed back to bash — Matteo, Commented May 7 at 20:15

remarkov · Accepted Answer · 2024-05-05 18:33:51Z

2

I would start with checking if there's anything related to the host in question in the SSH config files of the user, i.e. run cat /etc/nagios/.ssh/config and see if there's anything suspicious.

Next, I would try to clear up the known hosts file with ssh-keygen -R <host-ip-address>

These lines in the log look suspicious and make me think you have some local SSH config issues.

debug3: record_hostkey: found key type ED25519 in file /var/spool/nagios/.ssh/known_hosts:4
debug3: record_hostkey: found key type RSA in file /var/spool/nagios/.ssh/known_hosts:10
debug3: load_hostkeys_file: loaded 2 keys from casa.corti.li
debug1: load_hostkeys: fopen /var/spool/nagios/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory

PS: I would really recommend masking your domains and public IP address from the logs for security reasons.

answered May 5 at 18:33

remarkov

294 bronze badges

3

Those log entries are totally normal, and the result of ssh looking at various places to see if there are known hosts keys there. If you don't have a file in some of the locations that it checks then you normally get these entries indicating it didn't find a file there.
– Jason Kohles
Commented May 5 at 23:36
@JasonKohles I'm sorry, probably I was not clear enough explaining why I noted these lines. First two lines state that the host is found two times in the known_hosts file (lines 4 and 10) and both have different key types. It is possible that these values are outdated and it is better to clear them. The rest indeed are normal and just default, I was confused by the paths and thought there could be something wrong with the profile config.
– remarkov
Commented May 6 at 15:40

Add a comment |

Criggie · Accepted Answer · 2024-05-05 22:59:29Z

On the macmini, run grep nagios /etc/password or maybe finger nagios

user@macmini ~ % grep nagios /etc/passwd
nagios:*:178:178:Nagios User:/var/empty:/usr/bin/false

This means the nagios user's home directory is /var/empty/ which exists but is empty.
And that the nagios user's shell is /usr/bin/false which will exit immediately.

If finger works then it's output is something like this:

user@macmini ~ % finger nagios
Login: nagios                   Name: Nagios User
Directory: /var/empty                   Shell: /usr/bin/false
Never logged in.
No Mail.
No Plan.

These are both set like this for security.

One solution is to specify the shell you want to run. man ssh says

If a command is specified, it will be executed on the remote host instead of a login shell...

So try running this to set the shell command in the SSH parameters. This trick can also be used to run any valid command on the remote machine.

ssh -i /etc/nagios/.ssh/id_rsa -l nagios mymacmini /bin/bash

Your other option is to separate the SSH and the user-change with

remote_machine$  ssh corti@mymacmini
corti@mymacmini$  sudo su nagios -s /bin/bash
nagios@mymacmini$  whoami
nagios

Sorry for vagueness - I can't remember if finger is part of the default install or something I got via homebrew. — Criggie, Commented May 5 at 23:00
@Criggie doesn't the ssh -i command run the default shell which then runs the command? — mmmmmm, Commented May 8 at 6:32

Stack Exchange Network

ssh: connection closed

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
ssh
.

Hot Network Questions

ssh: connection closed

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged ssh.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
ssh
.